In-Vehicle Device, Service Providing Method, and Service Providing Program

This application is a continuation application of International Patent Application No. PCT/JP2024/020896 filed on Jun. 7, 2024, which designated the U.S. and claims the benefit of priority from Japanese Patent Application No. 2023-097691 filed in the Japan Patent Office on Jun. 14, 2023. The entire disclosures of all of the above applications are incorporated herein by reference.

The present disclosure relates to an in-vehicle device that provides a service to a vehicle, a service providing method, and a service providing program stored on a non-transitory storage medium.

A vehicle is used to provide a service. The inventors'study has revealed that suspending such use may cause disadvantage in some cases.

According to one aspect of the present disclosure, an in-vehicle device mounted on a vehicle and connected to a plurality of electronic control units in a vehicle control system comprises a cooperation controller configured to provide cooperation between a service application configured to provide a service to the vehicle and a control system function block configured to control the vehicle. The control system function block includes a function interface configured to convert an access request expressed in a vehicle-independent format into a vehicle-dependent format. The cooperation controller is configured to forward the access request to the control system function block. The cooperation controller is configured to determine whether or not a use suspension condition is satisfied and switch over operation of the vehicle control system based on function interface information, vehicle state information and user input information.

There is a technology where a vehicle includes: a controller that operates the vehicle based on operation information received from a management server; a management section that manages a compartment of the vehicle where a service user receives a service from a service provider; and an interface section that is set in association with service-related information provided by the service provider and the compartment.

When a service provider provides a service to a vehicle, it may be necessary to acquire, from a service provision target vehicle, vehicle information on the vehicle or to cause the target vehicle to perform a given operation or process.

When the service provider utilizes the vehicle by acquiring the vehicle information from the vehicle or by causing the vehicle to perform the given action or process, it may be desirable that the service provider should be charged for this utilization.

A detailed study by the inventors has revealed such an issue that when the above utilization by the service provider is uniformly suspended in cases where a charging-related factor (e.g., use fee exceeds an upper limit) requires to suspend the above utilization, this may impair convenience of the user using the service provided by the service provider.

The present disclosure improves service user convenience.

One aspect of the present disclosure is an in-vehicle device mounted a vehicle and connected to a plurality of electronic control units by an in-vehicle network, wherein the in-vehicle device and the plurality of electronic control units are included in a vehicle control system.

The in-vehicle device of the present disclosure comprises a cooperation controller configured to provide cooperation between a service application configured to provide a service to the vehicle and a control system function block configured to control the vehicle. The control system function block includes a function interface configured to convert an access request expressed in a vehicle-independent format and transmitted from the service applications into a vehicle-dependent format. The cooperation controller is configured to forward the access request, transmitted from the service application, to the control system function block.

The cooperation controller includes a use suspension determiner and a use controller.

The use suspension determiner is configured to determine whether or not a use suspension condition, which is preset and indicates that use of the function interface is required to be suspended by a factor related to charging for use of at least one of the service application or the function interface, is satisfied.

The use controller is configured to switch over operation of the vehicle control system based on: function interface information relating to the function interface for which the use suspension condition is satisfied; vehicle state information indicating a vehicle state; and user input information entered by a user who uses the vehicle.

The in-vehicle device of the present disclosure configured above switches over the operation of the vehicle control system based on the function interface information and the vehicle state information and the user input information. Because of this, the in-vehicle device of the present disclosure can suppress occurrence of a situation in which the use of the function interface is uniformly suspended when use of the function interface is required to be suspended by a factor related to charging and as a result the user becomes unable to use the service, improving convenience of the user using the service.

Another aspect of the present disclosure is a service providing method performed by an in-vehicle device mounted on a vehicle and connected to a plurality of electronic control units by an in-vehicle network, wherein the in-vehicle device and the plurality of electronic control units are included in a vehicle control system.

The in-vehicle device includes a cooperation controller configured to provide cooperation between a service application and a control system function block. The control system function block includes a function interfaces. The cooperation controller is configured to forward an access request, transmitted from the service application, to the control system function block.

In the service providing method of the present disclosure, the cooperation controller determines whether or not a use suspension condition, which is preset and indicates that use of the function interface is required to be suspended by a factor related to charging for use of at least one of the service application or the function interface, is satisfied. The use controller is configured to switch over operation of the vehicle control system based on: function interface information relating to the function interface for which the use suspension condition is satisfied; vehicle state information indicating a vehicle state; and user input information entered by a user who uses the vehicle.

The service providing method of the present disclosure is a method performed by the in-vehicle device of the present disclosure, and executing the method provides the same effect as the in-vehicle device of the present disclosure.

Yet another aspect of the present disclosure is a service providing program that causes a computer of an in-vehicle device to function as a function interface, a cooperation controller, a use suspension determiner and a controller, wherein the in-vehicle device is mounted on a vehicle and connected to a plurality of electronic control units by an in-vehicle network, wherein the in-vehicle device and the plurality of electronic control units are included in a vehicle control system.

A computer controlled by the service providing program of the present disclosure can constitute a part of the in-vehicle device of the present disclosure, and can provide the same effect as the in-vehicle device of the present disclosure.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.

1 FIG. 1 2 3 As illustrated in, a service providing systemof the present embodiment includes a vehicle control systemand a server.

2 3 The vehicle control systemis mounted on a vehicle and has a function of performing data communication with the servervia a wide-area wireless communication network NW.

3 2 3 The serverhas a function of performing data communication with the vehicle control systemvia the wide-area wireless communication network NW. In the server, an application store accessible via the wide-area wireless communication network NW or the Internet is installed.

2 2 The vehicle mounted with the vehicle control systemmay have an automated driving function in addition to a manual driving function. The vehicle may be a hybrid vehicle with an engine and an electric motor as the drive source for travel. The vehicle is not limited to a vehicle with an automated driving function and a hybrid vehicle, and may be a vehicle with only a manual driving function, or may be a vehicle with only an engine or only an electric motor as the drive source for travel. Hereinafter, the vehicle mounted with the vehicle control systemis simply referred to as the vehicle.

2 4 5 6 7 8 The vehicle control systemincludes a single ECU, a plurality of ECUs, a plurality of ECUs, a vehicle-outside communication device, and an in-vehicle communication network. The ECU is an abbreviation for electronic control unit.

4 5 The ECUcontrols the plurality of ECUsto provide cooperated control of the entire vehicle.

5 5 6 5 6 5 The ECUis provided for each domain, and the ECUprovided for a respective domain mainly controls ECUsexisting within that domain, where domains are those into which the vehicle is divided on a function basis. A respective ECUis connected to the ECUs, which are subordinate of this respective ECU, via an individually provided lower layer network (for example, CAN). CAN is an abbreviation for Controller Area Network. CAN is a registered trademark. The domains include, for example, powertrain, body, chassis, cockpit, etc.

6 5 6 6 6 The ECUsconnected to the ECUbelonging to the power train domain include, for example, an ECUfor controlling an engine, an ECUfor controlling a motor, an ECUfor controlling a battery, and the like.

6 5 6 6 The ECUsconnected to ECUbelonging to the body domain include, for example, an ECUfor controlling an air conditioner, an ECUfor controlling a door, and the like.

6 5 6 6 The ECUsconnected to the ECUbelonging to the chassis domain include, for example, an ECUfor controlling braking, an ECUfor controlling steering, and the like.

6 5 6 100 6 The ECUsconnected to the ECUbelonging to the cockpit domain include, for example, an ECUfor controlling display of a meter and a navigation device, an ECUfor controlling an input device operated by an occupant of the vehicle, and the like.

7 3 The vehicle-outside communication deviceperforms data communication with the servervia the wide-area wireless communication network NW.

8 4 5 7 4 5 4 7 The in-vehicle communication networkincludes CAN FD and Ethernet. Ethernet is a registered trademark. CAN FD is an abbreviation for CAN with Flexible Data Rate. CAN FD connects the ECUto each ECUand the vehicle-outside communication devicevia a bus. Ethernet individually connects between the ECUand a respective ECUand between the ECUand the vehicle-outside communication device.

4 4 4 4 4 4 4 4 a, b, c, a b a The ECUincludes, as its main component, a microcomputer including a CPUa ROMa RAMand the like. Various functions of the microcomputer are implemented by the CPUexecuting a program stored in a non-transitory tangible storage medium. In this example, the ROMcorresponds to the non-transitory tangible storage medium storing the program. Execution of the program causes execution of the method corresponding to the program. Pat or all of the functions executed by the CPUmay be configured as hardware by one or more ICs or the like. Further, the number of microcomputers included in the ECUmay be one or more.

4 4 4 d. d The ECUfurther includes a flash ROMThe flash ROMis a rewritable non-volatile memory.

5 6 7 4 5 6 7 5 6 4 5 5 6 7 Each of the ECU, the ECU, and the vehicle-outside communication deviceis an electronic control unit including, as its main component, a microcomputer including a CPU, ROM, RAM, and the like, similarly to the ECU. Further, the number of microcomputers included in each of the ECU, the ECU, and the vehicle-outside communication devicemay be one or more. The ECUsupervises one or more ECUs. The ECUsupervises one or more ECUsor supervises the ECUs,and the vehicle-outside communication deviceof the entire vehicle.

4 5 6 7 4 7 Hereinafter, unless otherwise specified, the ECU, ECU, ECU, and the vehicle-outside communication devicewill be collectively referred to as in-vehicle devicesto.

3 11 12 13 The serverincludes a controller, a communicator, and a storage.

11 11 11 11 11 11 11 11 a, b, c, a b a The controllerincludes, as its main component, a microcomputer including a CPUa ROMa RAMand the like. Various functions of the microcomputer are implemented by the CPUexecuting a program stored in a non-transitory tangible storage medium. In this example, the ROMcorresponds to the non-transitory tangible storage medium storing the program. Execution of the program causes execution of the method corresponding to the program. Part or all of the functions executed by the CPUmay be configured as hardware by one or more ICs or the like. The number of microcomputers included in the controllermay be one or more.

12 2 13 The communicatorperforms data communication with the vehicle control systemvia the wide-area wireless communication network NW. The storageis a storage device for storing various data.

1 9 9 The service providing systemfurther includes a servicer terminal device. The servicer terminal deviceis a device managed by the service provider SV (hereinafter referred to as “servicer SV”) described later, and is a personal computer, for example.

9 15 16 17 18 19 The servicer terminal deviceincludes a controller, a communicator, a storage, a display, and an operation input unit.

15 The controllerincludes, as its main component, a microcomputer including a CPU, a ROM, a RAM, and the like.

16 2 3 17 18 19 The communicatorperforms data communication with the vehicle control systemand the servervia the wide-area wireless communication network NW. The storageis a storage device for storing various data. The displayincludes a display device not shown in the drawings, and displays various images on a display screen of the display device. The operation input deviceoutputs input operation information to specify an input operation performed by a user via a keyboard and a mouse not shown in the drawings.

1 10 10 10 2 The service providing systemfurther includes a portable terminal device. The portable terminal deviceis an information processing terminal (e.g., smartphone or the tablet) carried by a driver of the vehicle (i.e., user US, described later). The portable terminal devicehas a function of performing data communication with the vehicle control systemvia the wide-area wireless communication network NW.

2 FIG. 4 20 30 30 4 4 20 30 a, As illustrated in, the ECUincludes a real-time processing unitand an application processing unit(hereinafter, app processing unit). When the ECUincludes multiple CPUsthe real-time processing unitand the application processing unitmay be implemented by processes executed by the same CPU or by processes executed by separate CPUs.

20 5 7 30 5 7 The real-time processing unitcooperates with in-vehicle devicestoconnected via CAN FD to perform vehicle control and the like that require real-time performance. The application processing unitcooperates with the in-vehicle devicestoconnected via the Ethernet to execute various applications (e.g., an entertainment application, etc.) that require high processing capability.

30 20 20 30 20 30 The application processing unithas a function of transmitting instructions and the like based on processing of various applications to the real-time processing unit. The real-time processing unithas a function of transmitting information and the like collected from the ECU and the like, to the application processing unitvia the CAN FD. As a result, the real-time processing unitand the application processing unitcooperation with each other to implement various functions.

2 2 Software of the vehicle control systemis built in line with AUTOSAR. The AUTOSAR is an abbreviation for Automotive Open System Architecture. The AUTOSAR is a registered trademark. The AUTOSAR provides not only communication between software components (hereinafter referred to as SW-C) provided to implement various applications, but also functions related to connection to the cloud, related to security, and the like. The SW-C is parted software to implement a certain function. The application program includes one or more SW-C. Note that the software of the vehicle control systemdoes not necessarily need to be built in line with AUTOSAR.

2 4 5 6 7 Each device belonging to the vehicle control system, that is, the ECU, the ECU, the ECU, and the vehicle-outside communication device, includes a platform. The platform provides an environment for running SW-C written in a hardware-independent format.

The platform includes a runtime environment (hereinafter, RTE) and basic software (hereinafter, BSW). RTE is an interface for connecting between SW-Cs and between SW-C and BSW. BSW is a hierarchy level connecting between hardware and SW-C, and includes OS, driver, middleware, etc. Functions of the BSW are divided into small modules and the function of each module is provided to the SW-C via API. The API is an abbreviation for Application Programming Interface.

20 21 21 30 31 31 Hereinafter, the platform included in the real-time processing unitis referred to as a first platform(hereinafter, first PF), and the platform included in the application processing unitis referred to as a second platform(hereinafter, second PF).

20 22 21 The real-time processing unitincludes a control-system function block groupwhich is a set of service applications (hereinafter, service application) operating on the first PF. The service application is an application that receives a request from a client, perform processing, and returns a result.

22 22 8 5 7 The control-system function block groupis a group of applications that include APIs for accepting instructions related to movement of the vehicle, for supervising the instructions accepted by the APIs to implement consistent vehicle control. The control-system function block groupoutputs various instructions via the in-vehicle communication networkto the in-vehicle devicestoin which there are entities that execute control based on the instructions.

21 211 211 20 30 211 30 The first PFincludes a conversion gateway. The conversion gatewayhas a function of converting a communication frame received by the real-time processing unitvia the CAN FD into an Ethernet format to provide the frame to the application processing unit. In addition, the conversion gatewayhas a function of converting the communication frame in the Ethernet format provided by the application processing unitinto a CAN format.

30 32 32 The application processing unitincludes a hypervisorand executes software on a plurality of virtual machines. The hypervisormay be omitted.

30 33 31 The application processing unitincludes a service-system function block groupwhich is a set of service applications operating on the second PF.

33 The service-system function block groupis a set of service applications. Each service application includes one or more SW-Cs. The service applications are provided by third parties as well as the vehicle manufacturer manufacturing the vehicle. Examples of the third party that provides the service application include a data utilization company that provides a service via collecting data from vehicles.

31 35 36 40 The second PFincludes a control-system function block group, a data-system function block group, and an API gateway.

35 33 35 37 33 20 The control-system function block groupis a set of programs including APIs for accepting requests related to the vehicle control from the service-system function block group. The control-system function block groupincludes an API groupbeing a plurality of APIs and converts an API access request expressed in a vehicle-independent format from the service-system function block groupinto an API access request expressed in a vehicle-dependent format to provide the request to the real-time processing unit. The “vehicle-independent format” is a format common to vehicles (i.e., a format that absorbs differences among vehicle types). The “vehicle-dependent format”is a format unique to a vehicle.

35 35 35 8 5 7 8 5 7 The APIs in the control-system function block groupinclude kinematic APIs for vehicle movement control and other non-kinematic APIs. The API access request accepted by the kinematic API is forwarded to the control-system function block group, and is forwarded from the control-system function block groupvia the in-vehicle communication networkto the in-vehicle devicetothat executes control based on the request. The API access request accepted by the non-kinematic API is forwarded via the in-vehicle communication networkto the in-vehicle devicetothat execute control based on the request.

36 20 36 20 36 7 7 The data-system function block groupis a set of programs including APIs for handling vehicle data acquired via the real-time processing unitand accumulated. The data-system function block grouphas a function of abstracting vehicle data in a vehicle-independent format from vehicle data expressed in a vehicle-dependent format supplied from the real-time processing unitto accumulate the vehicle data. The data-system function block groupmay have an API that provides a function of transmitting designated vehicle data to the ECU or the like via the Ethernet. In particular, when the destination is the vehicle-outside communication device, the vehicle-outside communication devicemay upload the transmitted vehicle data to the cloud.

5 7 35 5 7 36 It should be noted that communication with the in-vehicle devicetovia the control-system function block groupis not limited to CAN FD, but may be Ethernet or other communication means Communication with the in-vehicle devicetovia the data-system function block groupmay be performed not only by Ethernet, but also by CAN FD or other communication means.

40 35 36 The API gatewayis configured by utilizing a function of a virtual function bus (hereinafter referred to as VFB). VFB is middleware that enables communication between SW-Cs and between a SW-C and a BSW without consideration of hardware and communication protocols, etc., and is also called a software bus. Communication between SW-Cs is access from a SW-C to an API provided by another SW-C, and communication between a SW-C and a BSW is access from a SW-C to an API provided by the control-system function block groupand the data-system function block group.

40 Specifically, the SW-Cs access various APIs via the API gatewayand use the functions provided by the accessed APIs to implement desired functions.

For using an API, the SW-C transmits an API access request The API access request includes at least the application ID of the service application including the SW-C that is the request source and the API-ID being information indicating the API that is the request destination.

3 FIG. 14 3 14 1 14 14 9 1 1 14 14 As illustrated in, an application storeis installed in the server. The application storehas a function of registering a first service application SA, produced by the servicer SV, in the application storebased on an application by the servicer SV accessing the application storeby using the servicer terminal device, as indicated by the arrow L. The first service application SAregistered in the application storeis published on a website of the application store.

14 1 14 2 The application storealso has a function of registering the API used by the first service application SAin the application storebased on the application by the servicer SV, as indicated by the arrow L.

14 1 1 4 3 When the user US accesses the website of the application storeand purchases the first service application SA, the first service application SAis installed in the ECUmounted on the vehicle of the user US, as indicated by the arrow L.

1 40 4 40 35 5 35 20 When the first service application SAtransmits an API access request to the API gatewayas indicated by the arrow L, the API gatewayforwards the API access request to the control-system function block group, as indicated by the arrow L. The control-system function block groupconverts the API access requests into the API access requests expressed in the vehicle-dependent format to provide to the real-time processing unit, as described above.

40 14 6 The API Gatewaytransmits a statistics access log, including the number of API uses taking into account the execution accomplishment state of API access requests and a communication data amount associated with the API uses, to application store, as indicated by the arrow L.

40 14 1 14 7 Based on the statistics access log received from the API Gateway, the application storecalculates the API use fee due to the use of the API by the service application SAand charges the servicer SV the API use fee. The servicer SV pays the API use fee to the application store, as indicated by the arrow L.

14 1 1 14 8 14 9 The application storecalculates the application use fee for the first service application SAbased on the usage of the first service application SAand charges the user US the application use fee. The user US pays the billed application use fee to the application store, as indicated by the arrow L. The application storetransfers the application use fee paid by the user US to the servicer SV, as indicated by the arrow L.

10 1 40 40 2 1 As indicated by the arrow L, when the first service application SAtransmits an API access request to the API gateway, the API gatewaymay forward the API access request to the second service application SA, which provides a different service than the first service application SA.

A procedure when a servicer SV makes an API use agreement will be described next.

1 14 4 FIG. As indicated by a process Pin, the servicer SV accesses the application storeand applies for registration of the service application to be published and registration of the API to be used.

2 14 35 As indicated by a process P, the application storeexamines whether the control-system function block groupis accessible to the service application applied for by the service provider SV.

35 14 3 When the control-system function block groupis accessible to the service application applied for, the application storepresents a use API fee schedule to the servicer SV, as indicated by a process P.

14 13 1 For each API applied for, the application storestores API policy information including API-ID, reliability, and fee schedule in the storage, as illustrated in the table TB.

1 In the table TB, the API with API-ID of API1 is such that the reliability is “high” and the fee schedule is “call count-basis”, the API with the API-ID of API2 is such that the reliability is “low”and the fee schedule is “monthly-basis”.

An API to which the high reliability is set accepts API access requests that are from service applications with high reliability and rejects API access requests that are from service applications with low reliability.

An API to which the low reliability is set accepts API access requests even from service applications with low reliability.

The “call-count basis” refers to a charging form where a fee is added according to the number of times the API access request occurs. The “monthly basis” refers to a charging form where a flat fee independent of the number of times the API access request occurs is charged every month.

14 4 14 14 5 The servicer SV notifies the application storeof an agreement to the contract including the presented use API fee schedule, as indicated by a process P. As a result, the application storepublishes the service application applied for by the service provider SV on the website of the application store, as indicated by a process P.

14 13 The application storestores, in the storage, information on the service application published on the website (hereinafter, published application information) and information on the API authorized for the service application published on the website (hereinafter, API authorization information).

2 For each service application published, the published application information includes the application ID, the function name of the service application, the fee schedule of the service application, and the servicer ID, as illustrated in a table TB. The application ID is information for identifying the service application. The service provider ID is information for identifying the provider of the service application.

2 In the table TB, the service application with the application ID of APP1 is such that the function name is “Comfort Air Conditioning and the fee schedule is “use time basis” , and the servicer ID is “Dev1”. The service application with the application ID of APP2 is such that the function name is “Road Service”, the fee schedule is “Monthly basis”, and the servicer ID is “Dev1”.

The “use time basis” fee schedule is a charging form where a fee is added according to the use time of the service application. The “monthly basis” fee schedule is a charging form where a flat fee independent of the use time of the service application is charged every month.

3 For each API use of which is authorized, the API authorization information includes an API-ID and an application ID, as illustrated in the table TB.

3 The table TBillustrates that an API with the API-ID of API1 is called by a service application with the application ID of APP1, and an API with the API-ID of API2 is called by a service application with the application ID of APP2 API.

Next, description will be given of how a charging related factor causes use of the API to be suspended.

5 FIG. 40 40 35 1 2 11 12 13 As illustrated in, the API Gatewaydetermines whether or not the contract for API use has expired. When it is determined that the contract for API use has expired, the API Gatewaytransmits a first API use suspension request, which indicates that the expired API use is to be suspended, to the control-system function block group, the first service application SA, and the second service application SA, as indicated by arrows L, L, and L. The first API use suspension request is provided with the API-ID for identifying the API of which use is requested to be suspended.

6 FIG. 14 1 1 14 1 21 As illustrated in, the application storedetermines whether or not the payment by the user US of the use fee for the first service application SAis in arrears and whether or not the payment by the servicer SV for of the use fee for the API is in arrears. Then, when it is determined that the user US is in arrears on the payment of the use fee for the first service application SA, or when it is determined that the servicer SV is in arrears on the payment of the API use fee, the application storetransmits a second API use suspension request to the first service application SA, as indicated by the arrow L, wherein the second API use suspension request indicates that use of the API is to be suspended due to the arrears. The second API suspension request is provided with the API-ID for identifying the API of which use is requested to be suspended.

1 40 22 Upon receiving the second API use suspension request, the first service application SAtransmits the second API use suspension request to the API gateway, as indicated by the arrow L.

40 35 2 23 24 Upon receiving the second API use suspension request, the API gatewaytransmits the second API use suspension request to the control-system function block groupand the second service application SA, as indicated by the arrows Land L.

40 1 40 1 The API gatewayalso determines whether or not the fee for use of the first service application SAby the user US exceeds a charge upper limit set by the user US. In addition, the API Gatewaydetermines whether or not the fee for the API use by the first service application SAexceeds a charge upper limit set by the servicer SV.

1 40 35 1 2 Then, when it is determined that the use fee for the first service application SAexceeds the charge upper limit, or when it is determined that the API use fee exceeds the charge upper limit, the API gatewaytransmits a third API use suspension request to the control-system function block group, the first service application SAand the second service application SA, wherein the third API use suspension request indicates that use of the API is to be suspended because the charge upper limit is exceeded. The third API suspension request is provided with the API-ID for identifying the API of which use is requested to be suspended.

40 40 35 1 2 The API Gatewayalso determines whether or not a resource to perform the processing corresponding to the API is insufficient. Upon determining that the resource to perform the processing corresponding to the API is insufficient, the API gatewaytransmits a fourth API use suspension request to the control-system function block group, the first service application SAand the second service application SA, wherein the fourth API use suspension request indicates that the use of the API with the insufficient resource is to be suspended. The fourth API suspension request is provided with the API-ID for identifying the API of which use is requested to be suspended.

40 4 Next, a procedure of the API use control process performed by API Gatewaywill be described. The API use control process is repeatedly executed during the operation of the ECU.

40 40 10 7 FIG. When the API use control process is executed, the API gateway(hereinafter referred to as APIGW) determines in Swhether or not an API use suspension prediction is present, as illustrated in.

14 40 Specifically, upon receiving API use suspension prediction information from the application store, the APIGWdetermines that the API use suspension prediction is present. The API suspension prediction information includes a list of service applications that become unavailable due to suspending use of the API, the reason for suspending use of the API, the timing to suspend use of the API (e.g., “suspend the API in X minutes”), notes regarding suspending use of the API, and the additional fee charged.

40 40 40 The APIGWdetermines that the API use suspension prediction is present, also in such cases as when the API use contract has expired, when the service application use fee exceeds the charge upper limit, when the API use fee exceeds the charge upper limit, and when the resource to perform the processing corresponding to the API is insufficient. The APIGWtransmits the first, third, and fourth API use suspension requests described above after a preset waiting time has elapsed since the APIGWdetermined the presence of the API use suspension prediction.

40 10 40 20 40 Here, in the absence of the API use suspension prediction, the APIGWrepeats the process in Sto wait for the API use suspension prediction. When there is the API use suspension prediction, the APIGWnotifies the user US and the servicer SV that the service application is to be suspended, in S. In addition to the suspension of the service application, the APIGWnotifies the user US and servicer SV of the list of service applications that become unavailable due to suspending use of the API, the reason for suspending use of the API, the timing to suspend use of the API, the notes regarding suspending use of the API, and the additional fee charged.

40 100 40 Specifically, when the occupant is present in the vehicle, the APIGWnotifies the user US that the service application is to be suspended, for example, by displaying on the display screen of the navigation device. The APIGWdetermines whether or not an occupant is present in the vehicle by detecting, for each of a plurality of seats in the vehicle cabin, whether or not an occupant is seated based on the detection results of a plurality of seating sensors installed to the plurality of seats in the vehicle cabin.

40 10 10 4 When no occupant is present in the vehicle, the APIGWnotifies the portable terminal deviceof the user US that the service application is to be suspended. The phone number or e-mail address of the portable terminal deviceof the user US is pre-registered in the ECU.

40 9 The APIGWnotifies the servicer terminal deviceof the servicer SV that the service application is to be suspended.

30 40 14 40 40 In S, the APIGWdetermines whether or not it is timing to suspend use of the API. Specifically, upon receipt of the above second API use suspension request from the application store, the APIGWdetermines that it is timing to suspend use of the AP. Also, upon the timing to transmit the first, third, fourth API use suspension request described above, the APIGWdetermines that it is timing to suspend use of the API.

40 30 40 40 40 4 d. Here, when it is not the timing to suspend use of the API use, the APIGWrepeats the Sprocess to wait for the API use suspending timing. When it is timing to suspend the API use, the APIGWdetermines in Swhether or not, with respect to the API of which use is requested to be suspended (hereinafter referred to as “suspension target API”), there is a case where it is better not to permit to suspend use of the API. Specifically, the APIGWrefers to a no-permission setting table to determines whether or not, with respect to the suspension target API, there is a case in which it is be better not to permit to suspend use of the API, wherein in the no-permission setting table, API no-permission information indicative of whether no-permission possibility is present or absent is preset for each AP. The no-permission setting table is stored in the flash ROM

APIs that are not involved in cases where it is better not to permit to suspend use of the API include, for example, information-collection API, an API for improvement of the cabin space of the vehicle, and an entertainment API.

For example, APIs that are involved in cases where it is better not to permit to permit to suspend use of the API include an API directly related to a driving operation, an automatic driving system API, and an advanced driver assistance system API.

40 120 40 50 40 When, with respect to the suspension target API, there is no case in which it is be better not to permit to suspend the API use, the APIGWproceeds to S. On the other hand, when there is a case in which it is be better not to permit to suspend the API use, the APIGWdetermines in Swhether or not the vehicle is in motion. Specifically, the APIGWdetermines that the vehicle is in motion when the vehicle's travel speed is greater than or equal to a preset travel determination speed (e.g., 3 km/h).

40 70 40 60 40 When the vehicle is in motion, the APIGWproceeds to S. On the other hand, when the vehicle is not in motion, the APIGWdetermines in Swhether the vehicle is stopped. Specifically, APIGWdetermines that the vehicle is stopped when the vehicle speed is less than a preset stop determination speed (e.g., 3 km/h) and the shift position is in drive or neutral.

40 90 40 110 When the vehicle is stopped, the APIGWproceeds to S. On the other hand, when the vehicle is not stopped, the APIGWdetermines that the vehicle is parked, and proceeds to S.

70 40 8 FIG. Upon proceeding to S, as illustrated in, the APIGWprohibits suspending use of the suspension target API. This will result in additional fee for continued API use. The additional fee for continued API use will be calculated separately from regular charges. The additional fee may be covered by the user US or by the servicer SV. For example, the user may cover the excess fee for which the user US is responsible, and the servicer may cover the excess fee that are unavoidable with respect to safety consideration.

80 40 40 100 40 10 40 9 In S, the APIGWnotifies the user US and the servicer SV that suspending use of the suspension target API is prohibited, and ends the API use control process. Specifically, the APIGWnotifies the user US that suspending use of the suspension target API is prohibited by, for example, displaying on the display screen of the navigation devicewhen the occupant is present in the vehicle. When the occupant is not present in the vehicle, the APIGWnotifies the portable terminal deviceof the user US that suspending use of the suspension target API is prohibited. The APIGWnotifies the servicer terminal deviceof the servicer SV that suspending use of the suspension target API is prohibited.

90 40 20 Upon proceeding to S, the APIGWnotifies the user US and the servicer SV that the service application is to be suspended, as is the case of S.

100 40 40 40 40 In S, the APIGWdetermines whether or not the user US has permitted to suspend use of the API, based on the input operation by the user US via the above input device mounted on the vehicle. Specifically, if the user input information, which is output by the input device according to the input operation by the user US via the input device described above, indicates a permission to suspend use of the API, the APIGWdetermines that the user US has permitted to suspend use of the API. When the user input information indicates a refusal to suspend use of the API, the APIGWdetermines that the user US has not permitted to suspend use of the API. When the input device has not output user input information within the preset waiting time, the APIGWdetermines that the user US has not permitted to suspend use of the API use.

40 When the permission to suspend use of the API is not given by the user US, the APIGWends the API use control process. This will result in an additional fee for continued API use. The additional fee for continued API use will be calculated separately from regular charges.

110 40 40 Upon proceeding to S, the APIGWdetermines whether or not the vehicle user is in the vehicle. Specifically, the APIGWdetermines that the vehicle user is on board when one or more seats are occupied by one or occupants based on the detection results of multiple seating sensors.

40 90 40 120 When the vehicle user is in the vehicle, the APIGWproceeding to S. On the other hand, when the vehicle user is not in the vehicle, the APIGWsuspends use of the suspension target API in S.

130 40 20 In S, the APIGWnotifies the user US and the servicer SV of spending the service application in the same manner as in S, and ends the API use control process.

4 5 7 8 2 5 7 The ECUconfigured as described above is mounted on the vehicle, connected to the plurality of in-vehicle devicestoby the in-vehicle communication network, and constitutes the vehicle control systemtogether with the plurality of in-vehicle devicesto.

4 40 40 1 35 35 37 37 1 40 1 35 The ECUincludes the API gateway. The API gatewayis configured to provide cooperation between the first service application SAconfigured to provide the service to the vehicle and the control-system function block groupconfigured to control the vehicle. The control-system function block groupincludes the API group. The API groupis configured to convert the API access request expressed in the vehicle-independent format and transmitted from the first service application SAinto the vehicle-dependent format. The API gatewayis configured to forward the API access request, transmitted from the first service application SA, to the control-system function block group.

40 37 1 37 The API gatewayis configured to determine whether or not a use suspension condition, which is preset and indicates that use of the API groupis required to be suspended by a factor related to charging for use of at least one of the first service application SAor the API group, is satisfied.

40 2 35 36 2 35 36 The API gatewayis configured to switch over the operation of the vehicle control systembased on: the API no-permission information of the API satisfying the use suspension condition; the vehicle state information indicating the vehicle state; and the user input information entered by the user US who uses the vehicle. Although the control-system function block groupand the data-system function block groupare equipped with APIs, the switch over of the operation of the vehicle control systembased on the API no-permission information and the like is applied to the control-system function block groupand not to the data-system function block group.

4 2 4 The ECUswitches over the operation of the vehicle control systembased on the API no-permission information, the vehicle state information, and the user input information. Because of this, the ECUcan suppress occurrence of a situation in which the use of the API is uniformly suspended when use of the API is required to be suspended by a factor related to charging and the user US becomes unable to use the service, improving the convenience of the user US who uses the service.

40 2 4 The vehicle state information includes the traveling state information indicating the traveling state of the vehicle and the occupant presence absence information indicating whether the vehicle occupant is present or absent. The API gatewayis configured to switch over the operation of the vehicle control systemby determining whether to prohibit or permit to suspend use of the API based on the API no-permission information, the vehicle state information, and the user input information. Because of this, the ECUcan determine whether to prohibit or permit to suspend use of the API based at least on whether or not the vehicle is in motion and whether or not the occupant is present in the vehicle.

40 4 The API gatewayis configured to prohibit suspending use of the API, upon: determining, based on the API no-permission information, that there is a possibility that it is better not to permit to suspend use of the API; and determining, based on the traveling state information, that the vehicle is in motion. Because of this, the ECUcan suppress occurrence of a situation in which a necessary service cannot be used while the vehicle is in motion, further improving the convenience of the user US who uses the service.

40 4 4 The API gatewayis configured to permit to suspend use of the API upon: determining, based on the API no-permission information, that the there is a possibility that it is better not to permit to suspend use of the API; determining, based on the traveling state information, that the vehicle is stopped; and determining, based on the user input information, that the user US has permitted to suspend use of the API. Because of this, the ECUcan suspend the use of the API when the vehicle is stopped and the user US has permitted to suspend use of the API. In other words, the use of the API is suspended when the user US determines that the use of the API is not necessary. Therefore, even when the use of the API is suspended, the ECUcan suppress occurrence of a situation in which the service necessary for the user US becomes unavailable, further improving the convenience of the user US who uses the service.

40 4 4 The API gatewayis configured to permit to suspend use of the function API upon: determining, based on the API no-permission information, that there is a possibility that it is better not to permit to suspend use of the API; determining, based on the traveling state information, that the vehicle is parked: determining, based on the occupant presence information, that the occupant is present in the vehicle; and determining, based on the user input information, that the user US has permitted to suspend use of the API. Because of this, the ECUcan suspend the use of the API when the user US has permitted to suspend use of the API while the vehicle is parked. In other words, the use of the API is suspended when the user US determines that the use of the API is not necessary. Therefore, even when the use of the API is suspended, the ECUcan suppress an occurrence of a situation in which a service necessary for the user US becomes unavailable, further improving the convenience of the user US who uses the service.

40 4 4 The API gatewayis configured to permit to suspend use of the function API upon: determining, based on the API no-permission information, that there is a possibility that it is better not to permit to suspend use of the API; determining, based on the traveling state information, that the vehicle is parked; and determining, based on the occupant presence information, that no occupant is present in the vehicle. Because of this, the ECUcan suspend the use of the API when the vehicle is parked and no occupant is present in the vehicle. In other words, the use of the API is suspended when the user US who uses the service is not present in the vehicle. Therefore, even when the use of the API is suspended, the ECUcan suppress occurrence of a situation in which a service necessary for the user US becomes unavailable, further improving the convenience of the user US who uses the service.

40 4 The API Gatewayis configured to permit to suspend use of the API upon determining, based on the API no-permission information, that there is no possibility that it is better not to permit to suspend use of the API. In other words, an API of which suspending use poses no problem for the user US is uniformly suspended according to the factor related to charging. In this way, since the ECUsuspends use of the API of which suspending use poses no problem for the user US, it is possible to suppress the occurrence of a situation in which a service necessary for the user becomes unavailable to the user US even when the use of the API is suspended, further improving the convenience of the user US who uses the service.

40 40 1 4 1 The API gatewayis also configured to determine whether or not a use suspension prediction condition, which is preset and indicates that there is a possibility of suspending use of the API, is satisfied. The API gatewayis configured to notify the user US that the first service application SAthat uses this API is to be suspended, upon determining that use suspension prediction condition is satisfied. Because of this, the ECUcauses the user US to be aware of a possibility that the first service application SAbecomes unavailable.

40 100 10 4 1 The API gatewayis configured to notify the user US by using the navigation deviceinstalled in the vehicle when the occupant is present in the vehicle, and to notify the user by using the portable terminal devicepre-registered for the user US when the occupant is absent in the vehicle. Because of this, the ECUcan suppress occurrence of a situation in which the user US fails to recognize the suspension of use of the first service application SA.

4 5 6 7 8 In the embodiment described above: the ECUcorresponds to an in-vehicle device; the ECU, the ECU, and the vehicle-outside communication devicecorrespond to a plurality of electronic control units; and the in-vehicle communication networkcorresponds to an in-vehicle network.

1 35 40 37 The first service application SAcorresponds to a service application, the control-system function block groupcorresponds to a control system function block, the API gatewaycorresponds to a cooperation controller, and the API groupcorresponds to a function interface.

30 30 40 70 100 120 Scorresponds to processing by a use suspension determiner, the determination condition in Scorresponds to a use suspension condition, Sto Sand Sto Scorrespond to processing by a use controller, and the API no-permission information corresponds to function interface information.

10 10 20 100 10 Scorresponds to processing by a prediction determiner, the determination condition in Scorresponds to a use suspension prediction condition, Scorresponds to processing by a notifier, the navigation devicecorresponds to a first notification device, and the portable terminal devicecorresponds to a second notification device.

Although an embodiment of the present disclosure has been described above, the present disclosure is not limited to the above embodiment, and various modifications are possible.

The above embodiment illustrates determining whether or not there is a case where it is better not to permit to suspend use of the API, based on the API no-permission information indicating whether the no-permission possibility is present or absent. Alternatively, instead of whether the no-permission possibility is present or absent, the determination of whether or not there is a case where it is better not to permit to suspend the API use may be made based on the level (e.g., 0, 1, 2, 3, . . .) of the no-permission possibility.

The above embodiment illustrates prohibiting from suspending use of the API when the vehicle is in motion. Alternatively, prohibiting from suspending use of the API may cause the continued use of the API and then cause suspending use of the API at a time when it is safe to suspend use of the AP. When the vehicle has an automatic driving function, the vehicle may automatically transition to evacuation driving to suspend use of the API.

110 110 60 40 120 4 7 FIG. The above embodiment illustrates performing the process Sas illustrated in. Alternatively, the process Smay not be performed. Specifically, if the vehicle is not stopped in S, the APIGWmay proceeds to S. This enables the ECUto suspend use of the API as soon as possible.

100 The above embodiment illustrates determining whether the vehicle is in motion, stopped, or parked based on the vehicle travel speed and shift position, alternatively, the vehicle traveling state may be determined based on information from the navigation device.

The above embodiment illustrates that a charging-related factor causes use of the API to be suspended. Alternatively, the API use suspension may collectively control all APIs used by safety-critical service applications.

The above embodiment illustrates that a charging-related factor causes use of the API to be suspended. Alternatively, the API use suspension may be controlled by prohibiting startup of the service application or by forcibly terminating the service application.

4 4 4 4 The ECUand the method described in the present disclosure may be implemented by a dedicated computer provided by configuring a memory a processor programmed to execute one or more functions embodied by a computer program. Alternatively, the ECUand the methods described in the present disclosure may be implemented by a dedicated computer provided by configuring a processor with one or more dedicated hardware logic circuits. Alternatively, the ECUand the method described in the present disclosure may be implemented by one or more dedicated computers provided by configuring a memory and a processor programmed to execute one or more functions in combination with one or more hardware logic circuits. The computer program may be stored in a computer-readable non-transitory tangible storage medium as instructions to be executed by a computer. A method for providing functions of respective parts included in the ECUdoes not necessarily need to include software, and all of the functions may be provided using one or more hardware.

Multiple functions provided by a single element in the above-described embodiment may be provided by multiple elements, and a single function provided by a single element may be provided by multiple elements. Multiple functions provided by multiple elements may be provided by a single element, or one function provided by multiple elements may be provided by a single element. Part of the configuration of the above embodiment may be omitted. At least part of the configuration of the described above embodiment may be added to or replaced with another embodiment.

4 4 4 In addition to the ECUdescribed above, the present disclosure may be embodied into various forms such as a system including the ECUas a component, a program for causing a computer to function as the ECU, a non-transitory tangible storage medium such as a semiconductor memory storing this program, and a service providing method.